Skip to content

Commit ca70da4

Browse files
authored
test(serialize): additional tests for name, domain and path RFC validations (#171)
1 parent 47917c9 commit ca70da4

File tree

1 file changed

+126
-19
lines changed

1 file changed

+126
-19
lines changed

test/serialize.js

+126-19
Original file line numberDiff line numberDiff line change
@@ -17,24 +17,98 @@ describe('cookie.serialize(name, value)', function () {
1717
assert.equal(cookie.serialize('foo', ''), 'foo=')
1818
})
1919

20+
it('should serialize valid name', function () {
21+
var validNames = [
22+
'foo',
23+
'foo!bar',
24+
'foo#bar',
25+
'foo$bar',
26+
"foo'bar",
27+
'foo*bar',
28+
'foo+bar',
29+
'foo-bar',
30+
'foo.bar',
31+
'foo^bar',
32+
'foo_bar',
33+
'foo`bar',
34+
'foo|bar',
35+
'foo~bar',
36+
'foo7bar',
37+
];
38+
39+
validNames.forEach((name) => {
40+
assert.equal(cookie.serialize(name, 'baz'), `${name}=baz`, `Expected serialized value for name: "${name}"`);
41+
});
42+
});
43+
2044
it('should throw for invalid name', function () {
21-
assert.throws(cookie.serialize.bind(cookie, 'foo\n', 'bar'), /argument name is invalid/)
22-
assert.throws(cookie.serialize.bind(cookie, 'foo\u280a', 'bar'), /argument name is invalid/)
23-
assert.throws(cookie.serialize.bind(cookie, 'foo bar', 'bar'), /argument name is invalid/)
24-
})
25-
})
45+
var invalidNames = [
46+
'foo\n',
47+
'foo\u280a',
48+
'foo/foo',
49+
'foo,foo',
50+
'foo;foo',
51+
'foo@foo',
52+
'foo[foo]',
53+
'foo?foo',
54+
'foo:foo',
55+
'foo!foo',
56+
'foo{foo}',
57+
'foo foo',
58+
'foo\tfoo',
59+
'foo"foo',
60+
'foo<script>foo'
61+
];
62+
63+
invalidNames.forEach((name) => {
64+
assert.throws(
65+
cookie.serialize.bind(cookie, name, 'bar'),
66+
/argument name is invalid/,
67+
`Expected an error for invalid name: "${name}"`
68+
);
69+
});
70+
});
71+
});
2672

2773
describe('cookie.serialize(name, value, options)', function () {
2874
describe('with "domain" option', function () {
29-
it('should serialize domain', function () {
30-
assert.equal(cookie.serialize('foo', 'bar', { domain: 'example.com' }),
31-
'foo=bar; Domain=example.com')
32-
})
3375

34-
it('should throw for invalid value', function () {
35-
assert.throws(cookie.serialize.bind(cookie, 'foo', 'bar', { domain: 'example.com\n' }),
36-
/option domain is invalid/)
37-
})
76+
it('should serialize valid domain', function () {
77+
const validDomains = [
78+
'example.com',
79+
'sub.example.com',
80+
'my-site.org',
81+
'localhost'
82+
];
83+
84+
validDomains.forEach((domain) => {
85+
assert.equal(
86+
cookie.serialize('foo', 'bar', { domain }),
87+
`foo=bar; Domain=${domain}`,
88+
`Expected serialized value for domain: "${domain}"`
89+
);
90+
});
91+
});
92+
93+
it('should throw for invalid domain', function () {
94+
const invalidDomains = [
95+
'example.com\n',
96+
'sub.example.com\u0000',
97+
'my site.org',
98+
'domain..com',
99+
'.example.com',
100+
'example.com; Path=/',
101+
'example.com /* inject a comment */'
102+
];
103+
104+
invalidDomains.forEach((domain) => {
105+
assert.throws(
106+
cookie.serialize.bind(cookie, 'foo', 'bar', { domain }),
107+
/option domain is invalid/,
108+
`Expected an error for invalid domain: "${domain}"`
109+
);
110+
});
111+
});
38112
})
39113

40114
describe('with "encode" option', function () {
@@ -133,14 +207,47 @@ describe('cookie.serialize(name, value, options)', function () {
133207

134208
describe('with "path" option', function () {
135209
it('should serialize path', function () {
136-
assert.equal(cookie.serialize('foo', 'bar', { path: '/' }), 'foo=bar; Path=/')
137-
})
210+
const validPaths = [
211+
'/',
212+
'/login',
213+
'/foo.bar/baz',
214+
'/foo-bar',
215+
'/foo=bar?baz',
216+
'/foo"bar"',
217+
'/../foo/bar',
218+
'../foo/',
219+
'./'
220+
];
221+
222+
validPaths.forEach((path) => {
223+
assert.equal(
224+
cookie.serialize('foo', 'bar', { path }),
225+
`foo=bar; Path=${path}`,
226+
`Expected serialized value for path: "${path}"`
227+
);
228+
});
229+
});
138230

139231
it('should throw for invalid value', function () {
140-
assert.throws(cookie.serialize.bind(cookie, 'foo', 'bar', { path: '/\n' }),
141-
/option path is invalid/)
142-
})
143-
})
232+
const invalidPaths = [
233+
'/\n',
234+
'/foo\u0000',
235+
'/foo bar',
236+
'/path/with\rnewline',
237+
'/path\\with\\backslash',
238+
'/; Path=/sensitive-data',
239+
'/login"><script>alert(1)</script>'
240+
];
241+
242+
invalidPaths.forEach((path) => {
243+
assert.throws(
244+
cookie.serialize.bind(cookie, 'foo', 'bar', { path }),
245+
/option path is invalid/,
246+
`Expected an error for invalid path: "${path}"`
247+
);
248+
});
249+
});
250+
});
144251

145252
describe('with "priority" option', function () {
146253
it('should throw on invalid priority', function () {

0 commit comments

Comments
 (0)